petropy
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, which represents a theoretical surface for indirect prompt injection if malicious instructions were embedded in logs or configurations.
- Ingestion points: Ingests data from LAS (Log ASCII Standard) files and JSON configuration files in
scripts/formation_evaluation.py. - Boundary markers: No explicit delimiter-based safety prompts are used to isolate data from instructions.
- Capability inventory: The skill's capabilities are limited to file system read/write operations for data logs and plots. It does not possess network exfiltration, subprocess execution, or dynamic code evaluation capabilities.
- Sanitization: Uses standard scientific parsing libraries (lasio, petropy, and json) which treat inputs as data structures rather than executable code.
- [EXTERNAL_DOWNLOADS]: The skill utilizes several standard, open-source scientific Python packages for its calculations and data handling.
- Evidence: Dependencies identified in
SKILL.mdincludepetropy,lasio, andnumpy. Code references also suggest usage ofmatplotlibandpandasfor visualization and data exporting.
Audit Metadata